API returning "insufficient_permissions" when trying to access friend data.

[LaceyDomo]

Hi. I have an app that is trying to get friends data using https://api.fitbit.com/1/user/[userid]/activities/steps/date/today/30d.json.

As you can see, I am in fact friends with account 3CT869. Yet, I am getting "insufficient_permissions".

Our app is registered as a "Server" application type.

Any idea what I am doing wrong here?

[JeremiahFitbit · Accepted solution]

Please see https://community.fitbit.com/t5/Web-API/September-2016-Web-API-Breaking-Change/m-p/1512744#U1512744

If you want to access your friends' data, your friend will need to authorize your app.

[LaceyDomo]

How does a friend authorize my app? Can I get a step by step on how to do this?

[JeremiahFitbit]

1. Your friend needs to authorize your app. This process is documented here.
2. The OAuth consent flow will result in an OAuth 2 access token and refresh token for your friend. You'll now have an access token and refresh token for yourself and an access token and refresh token for your friend. To fetch data for yourself, use your access token. To fetch data for your friend, use their access token.

[RadimV]

Hello,

does it mean that my application has own an access token and refresh token and in each registered user will have an access token and refresh token as well ?

I am a bit confused here.

As an example : an application will be collecting data from let's say 5 registered friends.

To fetch data from friends, they need to register my application using the Authorization Code Grant flow, a link is here Authorization Code Grant Flow. Given the access and refresh token will be stored  and will be used my application to fetch all user activities in the future. I assume that the application will use user's tokens.

But how the application will be registered itself? Using the same authorization code grant flow ?

The application will receive the access and refresh token ? When ?

I think, that application should receive at the beginning an access token and refresh token, and this process should be done only once. 

I would appreciate any insight here.

Thanks.